CVE-2026-87902

3 SitRep stories cite CVE-2026-87902, newest first. The record itself is at cve.org.

1. Saturday, October 3, 2026 · Weekend editionWordPress 7.0.2 Path Traversal (CVE-2026-87902) Allows Local Include
2. Friday, September 25, 2026Active Exploitation: Roundcube CVE-2026-48842 and WordPress CVE-2026-87902
3. Thursday, September 24, 2026Update WordPress for CVE-2026-87902 or Isolate Affected Themes